From owner-freebsd-security@freebsd.org Tue Jul 21 13:40:58 2015 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EF58D9A511E for ; Tue, 21 Jul 2015 13:40:58 +0000 (UTC) (envelope-from marquis@roble.com) Received: from mx5.roble.com (mx5.roble.com [206.40.34.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mx5.roble.com", Issuer "mx5.roble.com" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id E29A6156C for ; Tue, 21 Jul 2015 13:40:58 +0000 (UTC) (envelope-from marquis@roble.com) Date: Tue, 21 Jul 2015 06:40:52 -0700 (PDT) From: Roger Marquis To: "freebsd-security@freebsd.org" Subject: Re: OpenSSH max auth tries issue In-Reply-To: <201507190220.UAA14096@mail.lariat.net> References: <55A95526.3070509@sentex.net> <201507190220.UAA14096@mail.lariat.net> User-Agent: Alpine 2.11 (BSF 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2015 13:40:59 -0000 Brett Glass wrote: > Because a potential intruder can establish multiple or "tag-teamed" TCP > sessions (possibly from different IPs) to the SSH server, a per-session limit > is barely useful and will not slow a determined attacker. A global limit > might, but would enable DoS attacks. If you run sshd under inetd the "-C" flag will enforce rate limits on a per IP basis. Still vulnerable to resource exhaustion under a DDOS perhaps but it would have to be a serious effort. Considering the potential interactions between inetd.conf, login.conf, sshd_config and perhaps fail2ban or portsentry it's surprising there isn't more documentation on this important topic. Roger >> >> https://kingcope.wordpress.com/2015/07/16/openssh-keyboard-interactive-authentication-brute-force-vulnerability-maxauthtries-bypass/ >> >> "OpenSSH has a default value of six authentication tries before it will >> close the connection (the ssh client allows only three password entries >> per default). >> >> With this vulnerability an attacker is able to request as many password >> prompts limited by the ???login graced time??? setting, that is set to two >> minutes by default." >>